Compliance-as-Code for AI-Driven Identity Systems: Clause-to-Control Traceability and Machine-Readable Evidence

Artificial intelligence (AI)-driven identity (ID) systems (document onboarding, wallet-based credential presentation, fraud/risk scoring) increasingly face regulatory obligations requiring demonstrable accountability, traceability, and technical documentation. Yet current compliance practice remains predominantly document-centric and manual, making it difficult to keep evidence synchronized with rapidly evolving systems and models.We present a compliance-as-code approach for AI-driven ID workflows that (i) maintains clause-to-control traceability under policy/configuration evolution, (ii) treats evidence completeness as an enforceable property via fixed monitoring-window semantics (silence is non-ambiguous), and (iii) exports evidence and outcomes as Open Security Controls Assessment Language (OSCAL)-native assessor packages (Component Definition, System Security Plan, Assessment Results, and automatically generated POA&M), where missing evidence is automatically materialized as structured findings and remediation items. We implement our approach using policy-as-code enforcement (OPA/Rego), CI configuration testing (Conftest), release-time provenance gates (policy bundle digests), runtime decision logging, and an evidence graph that binds events/resources to control IDs, releases, and hashes. We evaluate on two publicly reproducible ID workloads (MIDV-500 onboarding and OpenID4VP/W3C VC DM v2.0-aligned wallet verification). Across four releases, our prototype generates complete OSCAL packages with hash–linked evidence resources, automatically emits POA&M items for evidence gaps, surfaces window-level staleness as findings, and shows no material latency overhead under measured load. These results suggest that compliance-as-code can improve assessability and evidence integrity/attribution within a bounded threat model and control scope, as well as make AI-driven ID systems’ assurance more maintainable and assessor-ready.